Branch DC can ping and connect to PFSense WebGUI on the WAN port successfully (we set this up using the PfSense documentation).

DC1 and DC2 can connect outbound to the Branch DC.

There seems to be a rule that prevents internal access on the WAN port. However our rules are set to allow all traffic on the LAN and WAN ports. It would be ideal to just disable the firewall altogether since we already have a firewall but when we do this, PfSense doesn't allow any internal traffic at all. I look forward to any assistance and thank you ahead of time.

3 Answers
3

Without seeing your pfsense rules my inclination is to say "Working As Designed" -- most firewalls are configured to prevent people on the outside (WAN port) from accessing resources on the inside (LAN port).

If you want to let people from the outside in you need to either punch firewall holes (including 1:1 NAT or port redirection, if you're using NAT) or set up a VPN. The latter is a better solution in nearly every case...

We were trying to avoid using VPN since we already connect to our branch office using a Site-to-Site VPN. Regarding NAT, that would be the only other way then? We basically want our Domain Controllers to begin replicating properly again.
–
SeanJun 13 '11 at 19:53

This looks like a setup with a literal dedicated WAN (from the private IP used on it)...
–
rackandbonemanDec 14 '12 at 2:57